CVE-2023-2828: ISC BIND DNS Cache DoS Vulnerability

CVE-2023-2828 Overview

A resource exhaustion vulnerability has been discovered in ISC BIND 9's named DNS resolver that allows remote attackers to severely degrade the effectiveness of the cache-cleaning algorithm. When named is configured as a recursive resolver, it maintains a cache database to store responses from authoritative servers. The cache size is configurable via the max-cache-size statement, defaulting to 90% of available host memory. When cache utilization reaches 7/8 of the configured limit, a cleaning algorithm removes expired and least-recently-used RRsets to maintain memory constraints.

Researchers discovered that by querying the resolver for specific RRsets in a particular order, an attacker can effectively bypass this cache-cleaning mechanism, allowing memory usage to significantly exceed the configured max-cache-size limit. This can lead to denial of service conditions through memory exhaustion on DNS servers running affected BIND versions.

Critical Impact

Remote attackers can cause DNS servers to exceed configured memory limits, potentially leading to service degradation or denial of service through memory exhaustion on critical DNS infrastructure.

Affected Products

• ISC BIND 9.11.0 through 9.16.41
• ISC BIND 9.18.0 through 9.18.15
• ISC BIND 9.19.0 through 9.19.13
• ISC BIND 9.11.3-S1 through 9.16.41-S1 (Supported Preview Edition)
• ISC BIND 9.18.11-S1 through 9.18.15-S1 (Supported Preview Edition)
• Debian Linux 10.0, 11.0, 12.0
• Fedora 37, 38
• NetApp Active IQ Unified Manager
• NetApp H-Series Storage Systems (H300s, H410s, H410c, H500s, H700s)

Discovery Timeline

• 2023-06-21 - CVE-2023-2828 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-2828

Vulnerability Analysis

This vulnerability falls under CWE-770: Allocation of Resources Without Limits or Throttling. The core issue lies in the cache management algorithm used by BIND's named daemon when operating as a recursive resolver.

The named service implements a cache-cleaning mechanism designed to maintain memory usage within the bounds set by max-cache-size. Under normal operation, when cache utilization reaches 87.5% (7/8) of the configured limit, the daemon begins evicting expired and least-recently-used DNS resource records (RRsets) to free memory.

However, a flaw in the algorithm's logic allows carefully crafted query sequences to effectively "poison" the cache with RRsets that resist the cleaning process. By exploiting the specific ordering and types of queries, an attacker can cause the cache to grow beyond its configured limits, as the cleaning algorithm fails to identify these records for eviction.

Root Cause

The vulnerability stems from an algorithmic weakness in how named determines which cache entries to evict during cleanup cycles. The cache-cleaning algorithm uses heuristics to identify candidates for removal based on expiration times and access patterns. Specific query patterns can manipulate these heuristics, causing the algorithm to consistently skip certain cache entries during cleanup passes.

This results in a scenario where:

1. The cache fills to the 7/8 threshold triggering cleanup
2. The cleanup algorithm runs but fails to effectively reduce cache size
3. New queries continue adding entries, exceeding the configured limit
4. Memory consumption grows unbounded until system resources are exhausted

Attack Vector

The vulnerability is exploitable remotely over the network without authentication. An attacker needs only the ability to send DNS queries to a vulnerable recursive resolver. The attack does not require any user interaction.

The exploitation involves:

1. Identifying a target recursive DNS resolver running a vulnerable BIND version
2. Sending a carefully ordered sequence of DNS queries designed to populate the cache with RRsets that evade cleanup
3. Continuing the query pattern to progressively fill cache memory beyond configured limits
4. Eventually causing memory exhaustion that impacts DNS service availability

The attack requires sustained query traffic but can be executed from a single source or distributed across multiple sources to evade rate limiting.

Detection Methods for CVE-2023-2828

Indicators of Compromise

• Unusual memory growth on DNS servers beyond configured max-cache-size limits
• Gradual degradation of DNS query response times indicating resource pressure
• DNS server process (named) consuming significantly more memory than expected based on configuration
• System-level memory pressure alerts on DNS infrastructure hosts

Detection Strategies

• Monitor named process memory consumption relative to configured max-cache-size values
• Implement alerting when DNS server memory usage exceeds expected thresholds (e.g., 110% of max-cache-size)
• Analyze DNS query logs for unusual query patterns or high volumes from single sources
• Deploy network-based detection for anomalous DNS traffic patterns targeting recursive resolvers

Monitoring Recommendations

• Configure SNMP or similar monitoring to track BIND memory statistics via rndc stats
• Set up baseline monitoring of cache hit/miss ratios to detect anomalous cache behavior
• Enable DNS query logging with appropriate sampling to identify potential attack traffic
• Implement system-level memory monitoring with alerts for sustained high utilization

How to Mitigate CVE-2023-2828

Immediate Actions Required

• Update BIND to patched versions: 9.16.42, 9.18.16, 9.19.14, or their respective Supported Preview Edition equivalents
• For systems that cannot be immediately updated, consider temporarily reducing max-cache-size to provide additional memory headroom
• Review DNS server access controls to limit recursive query access to authorized clients only
• Monitor DNS server memory utilization closely until patches can be applied

Patch Information

ISC has released patched versions that address this vulnerability. Organizations should update to the following versions:

• BIND 9.16.42 or later for the 9.16.x branch
• BIND 9.18.16 or later for the 9.18.x branch
• BIND 9.19.14 or later for the 9.19.x branch
• Corresponding Supported Preview Edition releases

Detailed patch information is available from the ISC CVE-2023-2828 Documentation. Distribution-specific patches are available from Debian Security Advisory DSA-5439, Fedora Package Announcements, and NetApp Security Advisory.

Workarounds

• Restrict recursive DNS service access to only trusted, authorized client networks using BIND's allow-recursion directive
• Implement rate limiting on DNS queries using rate-limit configuration to reduce potential attack bandwidth
• Deploy DNS servers behind network-level protection that can filter anomalous query patterns
• Consider temporarily lowering max-cache-size to increase available memory buffer on affected systems

# Example BIND configuration hardening
# Add to named.conf options block

options {
    # Restrict recursive queries to trusted networks only
    allow-recursion { trusted-networks; };
    
    # Implement rate limiting
    rate-limit {
        responses-per-second 10;
        window 5;
    };
    
    # Consider reducing max-cache-size temporarily
    max-cache-size 50%;
};

# Define trusted networks ACL
acl trusted-networks {
    10.0.0.0/8;
    192.168.0.0/16;
    172.16.0.0/12;
    localhost;
};